From b5133e3bc30eed5e8ac2eb17d497a9216dc2e497 Mon Sep 17 00:00:00 2001
From: pengln <pengln@amonstack.com>
Date: Tue, 31 May 2022 15:55:05 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0uc01vn=E9=A1=B9=E7=9B=AE?=
 =?UTF-8?q?=E7=9A=84filebeat=E9=87=87=E9=9B=86=E5=A4=84=E7=90=86=E5=99=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../roles/filebeat/files/uc01vn_processor.js  | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 playbooks/roles/filebeat/files/uc01vn_processor.js

diff --git a/playbooks/roles/filebeat/files/uc01vn_processor.js b/playbooks/roles/filebeat/files/uc01vn_processor.js
new file mode 100644
index 0000000..7ed1e22
--- /dev/null
+++ b/playbooks/roles/filebeat/files/uc01vn_processor.js
@@ -0,0 +1,42 @@
+function process(event) {
+    var msg = event.Get("message");
+    var i
+
+    msg = msg.replace("/\r/g", "");
+    msg = msg.replace("/\n/g", "");
+    msg = msg.replace("/\r/\n/g", "");
+
+    var fields = msg.split("\t");
+
+    if (Number(fields[1]) == 64) {
+        // log_id = 64的日志是子后台同步过来的，需要特殊处理掉
+        event.Cancel(); return;
+    }
+
+    for (i = 0; i < 25; i++) {
+        if (fields[i] == null) {
+            fields[i] = "";
+        } else if (fields[i].trim() == "-") {
+            fields[i] = "";
+        } else {
+            fields[i] = fields[i].trim();
+        }
+    }
+
+    event.Put("log_datetime", fields[0]);
+    event.Put("log_id", fields[1]);
+    event.Put("role_id", fields[2]);
+    event.Put("role_name", fields[3]);
+    event.Put("account_id", fields[4]);
+
+    var ws = fields[4].split("_") // 从account_id分离spid和channel
+    // account_id中只有第一个部分是描述spid的，故spid和channel使用相同的信息填充
+    event.Put("spid", ws[0]);
+    event.Put("channel", ws[0]);
+
+    for (i = 5; i < fields.length; i++) {
+        event.Put("col" + (i - 4), fields[i]);
+    }
+
+    return event;
+}
\ No newline at end of file